The remote Debian 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-3342 advisory.

    -------------------------------------------------------------------------     Debian LTS Advisory DLA-3342-1                debian-lts@lists.debian.org     https://www.debian.org/lts/security/                      Markus Koschany     February 24, 2023                             https://wiki.debian.org/LTS
    -------------------------------------------------------------------------

    Package        : freeradius     Version        : 3.0.17+dfsg-1.1+deb10u2     CVE ID         : CVE-2022-41859 CVE-2022-41860 CVE-2022-41861

    Several flaws were found in freeradius, a high-performance and highly     configurable RADIUS server.

    CVE-2022-41859

        In freeradius, the EAP-PWD function compute_password_element() leaks         information about the password which allows an attacker to substantially         reduce the size of an offline dictionary attack.

    CVE-2022-41860

        In freeradius, when an EAP-SIM supplicant sends an unknown SIM option, the         server will try to look that option up in the internal dictionaries. This         lookup will fail, but the SIM code will not check for that failure.
        Instead, it will dereference a NULL pointer, and cause the server to crash.

    CVE-2022-41861

        A malicious RADIUS client or home server can send a malformed attribute         which can cause the server to crash.

    For Debian 10 buster, these problems have been fixed in version     3.0.17+dfsg-1.1+deb10u2.

    We recommend that you upgrade your freeradius packages.

    For the detailed security status of freeradius please refer to     its security tracker page at:
    https://security-tracker.debian.org/tracker/freeradius

    Further information about Debian LTS security advisories, how to apply     these updates to your system and frequently asked questions can be     found at: https://wiki.debian.org/LTS     Attachment:
    signature.asc     Description: This is a digitally signed message part

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Detections

Analytics

Debian dla-3342 : freeradius - security update

high Nessus Plugin ID 171904

Version 1.1

Version 1.0

Version 1.1 Jan 22, 2025, 5:44 PM CVSS metrics ("Cvssv4 score" set to 0.0) CVSSv2 severity (based on None, severity decreased from "High" to "Low") Plugin metadata Plugin Feed: 202501221744
Version 1.0 Feb 25, 2023, 5:57 AM New Plugin Feed: 202302250557